[ZeroGravitas]

I was going to suggest:

> initially try just being a faster, lighter or lower-power Electron or WebView.

But he mentioned it himself, though maybe someone might want to try this with no intention to become a full browser. Can you skip any of the tricky security requirements if it'll be bundled into an app? Or is that just asking for trouble?

[roca]

I think sooner or later you're going to want to load lower-trust content --- IFRAMEs of third-party Web content, or sandboxed extensions, or something like that. Building your entire architecture on the assumption you'll never have to do that is very risky.

[ameliaquining]

You could use the system webview for embedded third-party web content while using your own framework for trusted content.

[giantrobot]

> Or is that just asking for trouble?

The average Node project pulls in hundreds of dependencies. While you'd hope these would have some security vetting because of the Many Eyes theory, you have no fucking idea what your project is doing. Even a trivial Electron app is running a ridiculous amount of unreviewed third party code.

Just one module able to exercise some local exploit in your engine because you didn't fix Security Footgun #8176 screws over all of your users.

A browser engine that's been developed with a billion dollars of person hours runs that same untrusted third party code but has security guardrails everywhere.

[ameliaquining]

Aren't those dependencies trusted anyway? If they want to do something evil, they can just do it, they don't need to look for a zero-day in the engine they're running on.

[giantrobot]

The LCE doesn't need to be in the engine, the engine just needs to lack protections for the code to run something locally. As for Node dependencies being trusted, they are trusted but that's largely unearned trust.

[giancarlostoro]

So basically what Sciter does?

[jraph]

> Or is that just asking for trouble?

With the interactions an electron-like app might be doing with external services and the ton of JS third party library it could use, I think it would be indeed risky.

[cxr]

None of the security mitigations described in the post (nor any of those implemented in any browser engine) are aimed at protecting developers against themselves when they run an agglomeration of third-party modules as a single bundle under the same policy.

[jraph]

CSPs and mechanisms against cross site scripting are such protections. They would block a script from calling home or executing arbitrary scripts or displaying images that could exploit vulnerabilities.

So browser engines definitely protect developers against themselves a bit.

Although I agree with you that there's only so much you can do for the devs bundling crap themselves, I was wrong on this indeed.

Still, I would not be overly confident with web code running in a browser where security is not well studied if it has any network capacity. Especially if the app displays any external content in something like an iframe.

[ramon156]

Tauri basically?

[IshKebab]

No. Tauri is not a web browser. It uses the existing platform browser.

This would be more like Servo which I believe is focusing on embedded use cases. It makes sense because for Electron/embedded you don't need it to work for every site (really really hard), you only need it to work for one site. (Or a few hundred/thousand if you count all your users.) That is several orders of magnitude easier.